> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer - URL: https://f4n6.co.uk/security-feed/threat-actors-exploit-critical-ahsaycbs-flaws-to-drop-webshells-and-xmrig-cryptominer/ - Published: 2026-10-09T08:10:11.000Z - Updated: 2026-10-09T08:10:11.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-105133, CVE-2026-105134 ## 1\. Executive summary Threat actors are chaining two AhsayCBS vulnerabilities, CVE-2026-105133 (CVSS 5.5 MEDIUM, CWE-287) and CVE-2026-105134 (CVSS 9.3 CRITICAL, CWE-77 and CWE-78), to gain unauthenticated remote code execution as NT AUTHORITY/SYSTEM and deploy JSP webshells and XMRig cryptominers. Neither CVE is in CISA KEV; EPSS is 0% for CVE-2026-105133 and 2% for CVE-2026-105134, so exploitation is targeted rather than opportunistic at scale. AhsayCBS is used mainly by managed service providers and system integrators, which means an MSP compromise can expose the backup infrastructure of every downstream client it manages. The vendor fix is version 10.3.4, but Huntress has since confirmed that 10.3.4 is also affected, so no patched version is currently available and the only effective control is restricting access to the management interface. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ----------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28: ICT third-party risk, general principles | AhsayCBS is backup management software operated by MSPs and system integrators on behalf of clients, so the exploited component sits in the ICT supply chain of the affected financial entity. | Entities relying on an MSP-hosted AhsayCBS instance must treat the MSP as an ICT third-party provider and confirm whether their instance was exposed and whether the MSP has restricted management-interface access. | | DORA Art. 30: key contractual provisions with ICT third-party providers | The exploited product is delivered through an MSP relationship, and the vendor has no working patch, so remediation depends on contractual access to the provider's incident information and configuration changes. | Contract terms need to give the entity the right to obtain incident details and to require the provider to restrict or disable the management interface. Where those rights are absent, that gap is the finding. | | NIS2 Art. 21(2)(d): supply chain security measures | The compromise path runs through a third-party backup platform, and the affected version list changed after initial disclosure (10.3.4 is now also affected), so supply chain vulnerability information is unstable. | Entities in scope must be able to receive and act on corrected vendor and provider advisories, and must have a route to require the provider to apply compensating controls when no patch exists. | ## 3\. Technical analysis & attack chain AhsayCBS (Cloud Backup Server) is the management console for Ahsay's backup software. It centralises user management and backup policy configuration, and it is used mainly by managed service providers and system integrators. Huntress began observing exploitation on 2026-10-07 at 23:20:15 UTC, three days after the two vulnerabilities were identified on 2026-10-04. Confirmed attack chain: 1. The actor reaches the AhsayCBS management interface. Huntress does not describe the exposure mechanism beyond "exposed systems", so the entry condition is an internet-reachable or otherwise reachable CBS management interface. 2. CVE-2026-105133 is used to bypass authentication. The flaw is in the `checkSysPwd` function of `com/ahsay/obs/api/ApiStructsAction.java` and is classified as improper authentication (CWE-287). 3. CVE-2026-105134 is used to gain code execution. The flaw is in `/rps/api/json/UpdateReceivers.do`, part of the Replication Receiver component. The API contains an authentication bypass that allows a random token to substitute for valid credentials, and exploitation yields unauthenticated remote code execution as NT AUTHORITY/SYSTEM on the host. The verified reference data classifies this CVE as CWE-77 (Command Injection) and CWE-78 (OS Command Injection); the source describes the same flaw as an authentication bypass in the Replication Receiver API, and both descriptions can apply to the same endpoint. 4. After exploitation the actor configures a malicious receiver and drops a Java Server Page (JSP) webshell into the application directory served by the CBS application. In some incidents the JSP webshell was deployed immediately after exploitation. 5. In other incidents, `cbssvcX64.exe` spawned a series of commands that downloaded files from `hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com` into `%TEMP%` or `../AppData/Local/Temp`. The files were `Taskgmr.ps1`, `msedge.exe`, `edge.exe`, and `config.json`. Huntress attributes the download to a curl command issued from `cbssvcX64.exe`. 6. The actor runs the XMRig Monero miner. The miner binary is `edge.exe`, renamed to masquerade as a Microsoft Edge process, and dropped into a Temp folder. 7. PowerShell is executed to modify `config.json` in the Temp folder, configuring the miner. 8. The miner connects on port 8029 to an XMR pool at `51.195.127[.]124:8029` and `xmr.kryptex[.]network`. 9. Persistence is established by creating a Windows service named `MicrosoftEdgeUpdateSvc`, chosen to resemble the legitimate Microsoft Edge Update service (`edgeupdate`). The service runs `msedge.exe` from the Temp folder with SYSTEM privileges. The initial detection signal was suspicious command lines spawning from the AhsayCBS executable `cbssvcX64.exe`. Confidence and sourcing. This advisory rests on a single source, the Huntress writeup. The vulnerability locations, the exploitation chain, the dropped filenames, the service name, and the mining pool endpoints are single-sourced; verify before enforcement. No MITRE ATT&CK profile is provided for the actor in the verified reference data, and Huntress does not name an actor, so attribution is unconfirmed. The source does not state how many victims were affected, which sectors they are in, or whether any data was accessed or exfiltrated. ## 4\. Mitigation & containment P1, within 24 hours: - Restrict access to the AhsayCBS management interface. This is the only control Huntress recommends while no patch exists. Where the interface does not need to be internet-facing, remove the external exposure; where it does, allow-list source addresses and require access through an authenticated reverse proxy or VPN. - Do not treat version 10.3.4 as fixed. Huntress has confirmed 10.3.4 is affected. If your estate was upgraded to 10.3.4 on the basis of the initial report, the exposure remains. - Hunt for the persistence service. Check for a Windows service named `MicrosoftEdgeUpdateSvc` and compare it against the legitimate `edgeupdate` service. A service with that name running `msedge.exe` from a Temp folder with SYSTEM privileges is malicious. - Hunt for the dropped files in `%TEMP%` and `../AppData/Local/Temp`: `Taskgmr.ps1`, `msedge.exe`, `edge.exe`, `config.json`. Note that `msedge.exe` and `edge.exe` in a Temp folder are not the legitimate Edge binaries. - Block outbound connections to `51.195.127[.]124:8029` and `xmr.kryptex[.]network`, and block the download host `imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com`. These are single-sourced indicators; confirm against your own telemetry before adding them to permanent deny lists. - Search for JSP webshells in the AhsayCBS web application directory. Huntress does not give the directory path or a webshell filename, so review recently created or modified `.jsp` files in the CBS application tree rather than matching a known name. - Review process lineage for `cbssvcX64.exe`. Any child process, particularly `cmd.exe`, `powershell.exe`, or `curl.exe`, is a strong indicator of compromise. P2, within 72 hours: - Isolate any host showing the service, the dropped files, or the mining pool connections, and treat it as fully compromised at SYSTEM level. Rebuild rather than clean where the JSP webshell was deployed, since the actor had code execution in the application directory. - Audit the AhsayCBS instance for unauthorised receiver configuration. The exploited endpoint is `/rps/api/json/UpdateReceivers.do`, and the actor's first post-exploitation step was to configure a malicious receiver. Review configured replication receivers and remove any that are not recognised. - If you consume AhsayCBS through an MSP, ask the provider directly whether their instance was exposed, whether the management interface is now restricted, and whether they have reviewed receiver configuration and the application directory for webshells. The provider may not have applied the corrected 10.3.4 guidance. P3, within 7 days: - Track Ahsay's advisory for a version that fixes both CVEs. Huntress states it has shared research with Ahsay and that no patch is available at the time of writing; do not assume 10.3.4 is the fix. - Add detection for the XMRig pool connection pattern and for the `MicrosoftEdgeUpdateSvc` service name to endpoint and network monitoring. - Where the CBS instance supports backup infrastructure for downstream clients, review whether the compromise window gave the actor access to backup data or backup credentials. The source does not describe data access or exfiltration, so this is a scoping question, not a confirmed finding. ## 5\. Indicators of compromise | type | value | confidence | source | | -------- | ----------------------------------------------------- | ---------------------- | -------- | | domain | imagefiles-backup.oss-ap-southeast-7.aliyuncs\[.\]com | medium, single-sourced | Huntress | | ipv4 | 51.195.127\[.\]124:8029 | medium, single-sourced | Huntress | | domain | xmr.kryptex\[.\]network | medium, single-sourced | Huntress | | filename | Taskgmr.ps1 | medium, single-sourced | Huntress | | filename | msedge.exe | medium, single-sourced | Huntress | | filename | edge.exe | medium, single-sourced | Huntress | | filename | config.json | medium, single-sourced | Huntress | | service | MicrosoftEdgeUpdateSvc | medium, single-sourced | Huntress | | process | cbssvcX64.exe | medium, single-sourced | Huntress | ```iocs domain imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com ipv4 51.195.127[.]124:8029 domain xmr.kryptex[.]network filename Taskgmr.ps1 filename msedge.exe filename edge.exe filename config.json service MicrosoftEdgeUpdateSvc process cbssvcX64.exe ``` No file hashes are present in the source material, so none are listed. The source gives no webshell filename or application directory path. Behavioural indicators: | behaviour | where to observe | confidence | | ------------------------------------------------------------------------------ | ------------------------------------------------------ | ---------------------- | | cbssvcX64.exe spawning command-line or PowerShell child processes | EDR process lineage, Windows process creation events | medium, single-sourced | | JSP file created or modified in the AhsayCBS web application directory | File integrity monitoring on the CBS application tree | medium, single-sourced | | Outbound connection on port 8029 to an XMR pool | Network flow logs, firewall egress logs | medium, single-sourced | | Windows service created with a name resembling a Microsoft Edge update service | Windows service creation events, registry service keys | medium, single-sourced | | msedge.exe or edge.exe executing from a Temp folder | EDR process image path telemetry | medium, single-sourced | ## 6\. Detection ```yara rule AhsayCBS_XMRig_Dropper_Indicators { meta: author = "Adverse Trace" date = "2026-10-09" reference = "https://www.huntress.com/blog/ahsaycbs-flaws-exploit" description = "Detects artefacts associated with post-exploitation of AhsayCBS CVE-2026-105133 and CVE-2026-105134, including the dropped PowerShell script, the masquerading miner binary, and the persistence service name." strings: $s1 = "Taskgmr.ps1" ascii wide $s2 = "MicrosoftEdgeUpdateSvc" ascii wide $s3 = "imagefiles-backup.oss-ap-southeast-7.aliyuncs" ascii wide $s4 = "xmr.kryptex" ascii wide $s5 = "51.195.127.124" ascii wide $s6 = "UpdateReceivers.do" ascii wide condition: uint16(0) == 0x5A4D and 2 of them } ``` The rule is written for the dropped Windows artefacts and for scripts or configuration files that reference the actor's infrastructure. `UpdateReceivers.do` is included because it is the exploited endpoint path and appears in the malicious request rather than only in reporting; if your environment generates high noise on that string from legitimate CBS traffic, drop `$s6` and require the remaining strings. ```yaml title: AhsayCBS Post-Exploitation Service and Miner Persistence id: 8f2c1a44-7d3e-4b91-9c02-6a5e0d1b7f30 status: experimental description: Detects creation of the MicrosoftEdgeUpdateSvc persistence service and execution of masquerading Edge binaries from Temp folders, as observed in AhsayCBS exploitation. author: Adverse Trace date: 2026/10/09 references: - https://www.huntress.com/blog/ahsaycbs-flaws-exploit logsource: product: windows service: system detection: selection_service: EventID: 7045 ServiceName: 'MicrosoftEdgeUpdateSvc' selection_image: Image|endswith: - '\msedge.exe' - '\edge.exe' Image|contains: - '\Temp\' - '\AppData\Local\Temp\' condition: selection_service or selection_image falsepositives: - Legitimate Microsoft Edge update activity, which uses the service name edgeupdate and installs under Program Files rather than Temp level: high ``` ```yaml title: AhsayCBS Child Process Spawning from cbssvcX64 id: 2b7d9e10-5c48-4a6f-b3d1-90e4c7a2f815 status: experimental description: Detects command-line or PowerShell child processes spawned by the AhsayCBS service binary, the initial detection signal for CVE-2026-105133 and CVE-2026-105134 exploitation. author: Adverse Trace date: 2026/10/09 references: - https://www.huntress.com/blog/ahsaycbs-flaws-exploit logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: '\cbssvcX64.exe' selection_child: Image|endswith: - '\cmd.exe' - '\powershell.exe' - '\curl.exe' condition: selection_parent and selection_child falsepositives: - Administrative scripts invoked by the CBS service; baseline before alerting level: high ``` ## CVE assessment 2 referenced CVEs — 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | ------------ | --------- | ---- | --------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-105134](https://nvd.nist.gov/vuln/detail/CVE-2026-105134?ref=f4n6.co.uk) | 9.3 Critical | — | 2% | A flaw has been found in Ahsay AhsayCBS up to 10.3.2\. This vulnerability affects unknown code of the file /rps/api/json/UpdateR… | | [CVE-2026-105133](https://nvd.nist.gov/vuln/detail/CVE-2026-105133?ref=f4n6.co.uk) | 5.5 Medium | — | 0% | A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2\. This affects the function checkSysPwd of the file com/ahsay/obs/ap… | ## 7\. Sources - Huntress, "Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer", https://www.huntress.com/blog/ahsaycbs-flaws-exploit, published 2026-10-08, updated 2026-10-08 18:00 ET. ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-105134 as the driver of this incident at CVSS 9.3 CRITICAL with unauthenticated remote code execution as SYSTEM, and CVE-2026-105133 as the authentication-bypass step that makes the chain work at CVSS 5.5 MEDIUM. Neither CVE is in CISA KEV and EPSS is 0% and 2% respectively, so this is targeted exploitation of reachable AhsayCBS management interfaces rather than broad scanning, and the practical risk to a client is proportional to whether it or its MSP exposes that interface. The material problem for clients is that the vendor fix named in the first report, 10.3.4, is itself affected, so there is currently no patched version and the only control is restricting management-interface access; anyone who closed this out on the 10.3.4 upgrade has an open exposure. Our assessment rests on a single source, Huntress, and the actor is unnamed with no MITRE ATT&CK profile in our reference data, so we treat attribution as unconfirmed and the IOC set as single-sourced pending corroboration. We will track Ahsay's advisory for a version that fixes both CVEs, re-issue this note if the affected-version list changes again, and contact clients running AhsayCBS or consuming it through an MSP to confirm management-interface exposure and check for the `MicrosoftEdgeUpdateSvc` service and the dropped Temp files. --- [Read the original source →](https://www.huntress.com/blog/ahsaycbs-flaws-exploit?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*